news

news · 13 min
Bulletin — May 2026
The Digital Omnibus reaches a provisional deal on 7 May: Annex III moves to December 2027. Spain approves its AI governance bill on 26 May. Pwn2Own Berlin pays out $1.3M for 47 zero-days, with Codex and Claude Code on the menu. Patch Tuesday ships with no zero-days for the first time since June 2024. OpenAI launches Daybreak and Anthropic moves Mythos toward GA. Verizon DBIR 2026 crowns vulnerability exploitation as the number-one vector. GitHub loses 3,800 internal repos to a poisoned VS Code extension.
1 jun 2026 · Manuel López Pérez
news · 13 min
Bulletin — April 2026
The Omnibus trilogue closes without agreement on 28 April, leaving the original AI Act deadline three months away. Patch Tuesday with 165 CVEs and an active SharePoint zero-day. Anthropic announces Claude Mythos + Project Glasswing — the first frontier model held behind a defensive wall. Pwn2Own Berlin collapses under oversubscription. M&S one year on. AESIA publishes guides 13 and 14.
1 may 2026 · Manuel López Pérez
news · 17 min
Bulletin — March 2026
LiteLLM supply chain: TeamPCP compromised Trivy first to reach the PyPI credentials of the maintainer and ship litellm 1.82.7 / 1.82.8 with a 3-stage payload. nginx-ui MCPwn (CVE-2026-33032, CVSS 9.8) exploited in the wild. Patch Tuesday loud on AI: XBOW takes the month's CVSS 9.8. Mandiant M-Trends 2026 reports 22 seconds between initial access and ransomware. VMware Aria Operations in CISA KEV. NVIDIA GTC presents NemoClaw for agentic security. DORA first Register of Information with 31 March deadline.
1 abr 2026 · Manuel López Pérez
news · 11 min
Bulletin — February 2026
The month of hard anniversaries: AI Act Art. 5 turns one on 2 February, ByBit turns one on the 21st. India AI Impact Summit in Delhi replaces the Paris Action Summit. Patch Tuesday with 6 zero-days. CrowdStrike GTR 2026 puts breakout time at 29 minutes. Mandiant opens M-Trends 2026 promo (April publication). DORA enters active enforcement after the grace period. CISA KEV with three updates.
1 mar 2026 · Manuel López Pérez
news · 11 min
Bulletin — January 2026
DORA turns one on the 17th. The ESAs published 19 CTPPs in November. DeepSeek slips V4 and ships Engram + an updated R1. Moonshot drops Kimi K2.5 multimodal with agent swarm. Patch Tuesday with a DWM zero-day. Ivanti EPMM pre-auth RCE exploited on 29 January. Trump opens litigation against state AI laws. Hugging Face publishes its open-weights year in review.
1 feb 2026 · Manuel López Pérez
news · 9 min
Bulletin — December 2025
Cl0p insists a year after Cleo. OpenAI repeats Shipmas. Anthropic closes the year with a Claude refresh. DORA and NIS2 enter the first inspection cycle. Year-end reports from Mandiant, CrowdStrike and Verizon. The year in one table.
1 ene 2026 · Manuel López Pérez
news · 12 min
Bulletin — November 2025
Anthropic publishes the first case of espionage with an autonomous coding agent. Microsoft Ignite and AWS re:Invent put "agent security" into product: Entra Agent ID GA, AgentCore Policy in preview with Cedar. FortiWeb 0-day CVE-2025-64446 exploited in the wild. Cloudflare down for 4 hours on the 18th over a badly-generated feature file. Logitech joins the Cl0p / Oracle E-Business cluster. Patch Tuesday with CVE-2025-62215 zero-day in Windows Kernel.
1 dic 2025 · Manuel López Pérez
news · 9 min
Bulletin — October 2025
Windows 10 closes ten years of support. F5 discloses source code theft and unpublished CVEs by a nation-state. Patch Tuesday with three zero-days in use, WSUS RCE wormable with out-of-band patch. AWS US-East-1 down for 15 hours. Claude Haiku 4.5 and Sonnet 4.5 in production.
1 nov 2025 · Manuel López Pérez
news · 11 min
Bulletin — September 2025
The month ArcaneDoor returned with a ROM bootkit. Cisco ships the emergency advisory for CVE-2025-20333 and CVE-2025-20362 on 25 September and CISA issues ED 25-03 the same day; Apple ships iPhone 17 with Memory Integrity Enforcement, the first always-on memory safety defence in a consumer product; Salesforce patches ForcedLeak in Agentforce; Jaguar Land Rover halts production for three weeks; Asahi Japan loses its entire distribution chain.
1 oct 2025 · Manuel López Pérez
news · 12 min
Bulletin — August 2025
AI Act GPAI in application with 26 signatories and Meta out. Trump publishes the AI Action Plan. Black Hat and DEF CON dominate the first week — AgentFlayer exposes zero-click in enterprise agents, ATLANTIS wins AIxCC with 18 real patched zero-days. WinRAR CVE-2025-8088 exploited by eight groups. Exchange hybrid CVE-2025-53786 with ED 25-02. Salt Typhoon: 13-country advisory.
1 sept 2025 · Manuel López Pérez
news · 10 min
Bulletin — July 2025
Month with two threads: the ToolShell chain puts SharePoint on-prem at the centre of the year, and the reasoning model jailbreaks retrospective settles what H1 leaves on the table. Patch Tuesday with 137 CVEs and a zero-day in SQL Server. Citrix Bleed 2 exploited in the wild. UK retail postmortems: M&S declares 270-440 million in impact. CrowdStrike Falcon turns one year since Channel File 291.
1 ago 2025 · Manuel López Pérez
news · 10 min
Bulletin — June 2025
Project Vend shows that letting a Claude agent run a vending machine for a month ends in tungsten cubes and an identity crisis. EchoLeak (CVE-2025-32711) marks the first zero-click prompt injection with an assigned CVE against Microsoft 365 Copilot. AWS re:Inforce, Apple WWDC25 with Foundation Models, Citrix Bleed 2 exploited as zero-day, and M&S and Co-op keep picking up shards after the April wave.
1 jul 2025 · Manuel López Pérez

Newer posts

Older posts